0ce3dd3db854014728a5b4f6743df5d0831920a2786c379583cefbd2cd7c7ee9

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 06:54

Target

cd668be1f97bcc9a794c664b90a02ff2.dll
Size

100KB
MD5

cd668be1f97bcc9a794c664b90a02ff2
SHA1

73b25fa86c04db352ab191b67816f67aff517bb0
SHA256

0ce3dd3db854014728a5b4f6743df5d0831920a2786c379583cefbd2cd7c7ee9
SHA512

4bd8c834c4069e290f164bed548e74bfa4168a59c8fbe32e8f7de164a4aa2ba31774facb697669ac878ed7af6eb57638734f8dd8dff708ae6dcf27671c0b7f93
SSDEEP

1536:HUte7/RZ1PqVN2qwNQ3EMdswDDWMiJ4FZQ5emRqtV28MJ3HBvD8/Kpxd:HUtS5uzpPM2ZlmotBMJe/Kp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2148	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2148	808	rundll32.exe	89
PID 808 wrote to memory of 2148	808	rundll32.exe	89
PID 808 wrote to memory of 2148	808	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd668be1f97bcc9a794c664b90a02ff2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd668be1f97bcc9a794c664b90a02ff2.dll,#1
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 544
    3⤵
    - Program crash
    PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2148 -ip 2148
1⤵
PID:5068

memory/2148-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download